summaryrefslogtreecommitdiff
path: root/dev-qt/qtcore/files
diff options
context:
space:
mode:
authorV3n3RiX <venerix@redcorelinux.org>2020-04-12 03:41:30 +0100
committerV3n3RiX <venerix@redcorelinux.org>2020-04-12 03:41:30 +0100
commit623ee73d661e5ed8475cb264511f683407d87365 (patch)
tree993eb27c93ec7a2d2d19550300d888fc1fed9e69 /dev-qt/qtcore/files
parentceeeb463cc1eef97fd62eaee8bf2196ba04bc384 (diff)
gentoo Easter resync : 12.04.2020
Diffstat (limited to 'dev-qt/qtcore/files')
-rw-r--r--dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch98
-rw-r--r--dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch106
2 files changed, 106 insertions, 98 deletions
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch
deleted file mode 100644
index 055794b51964..000000000000
--- a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 1232205e32464d90e871f39eb1e14fcf9b78a163 Mon Sep 17 00:00:00 2001
-From: Rainer Keller <Rainer.Keller@qt.io>
-Date: Tue, 27 Aug 2019 14:44:48 +0200
-Subject: [PATCH] Fix crash when text contains too many directional chars
-
-In case a text to be layouted contains more than 128 directional characters
-it causes the application to crash
-
-The function initScriptAnalysisAndIsolatePairs() collects information of
-RTL/LTR chaaracters into vector "isolatePairs". The size of the vector is
-capped to 128. Later the function generateDirectionalRuns() iterates
-the text again and tries to access items from the previously capped vector
-above the upper bound.
-
-Task-number: QTBUG-77819
-Change-Id: Ibb7bf12c12b1db22f43ff46236518da3fdeed26a
-Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
----
- src/gui/text/qtextengine.cpp | 15 +++++++--------
- tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp | 17 +++++++++++++++++
- 2 files changed, 24 insertions(+), 8 deletions(-)
-
-diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp
-index 2da13289bfd..a7834587b1e 100644
---- a/src/gui/text/qtextengine.cpp
-+++ b/src/gui/text/qtextengine.cpp
-@@ -399,6 +399,7 @@ struct QBidiAlgorithm {
- analysis[i].bidiDirection = (level & 1) ? QChar::DirR : QChar::DirL;
- runHasContent = true;
- lastRunWithContent = -1;
-+ ++isolatePairPosition;
- }
- int runBeforeIsolate = runs.size();
- ushort newLevel = isRtl ? ((stack.top().level + 1) | 1) : ((stack.top().level + 2) & ~1);
-@@ -440,21 +441,19 @@ struct QBidiAlgorithm {
- doEmbed(true, true, false);
- break;
- case QChar::DirLRI:
-- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i);
- doEmbed(false, false, true);
-- ++isolatePairPosition;
- break;
- case QChar::DirRLI:
-- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i);
- doEmbed(true, false, true);
-- ++isolatePairPosition;
- break;
- case QChar::DirFSI: {
-- const auto &pair = isolatePairs.at(isolatePairPosition);
-- Q_ASSERT(pair.start == i);
-- bool isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft();
-+ bool isRtl = false;
-+ if (isolatePairPosition < isolatePairs.size()) {
-+ const auto &pair = isolatePairs.at(isolatePairPosition);
-+ Q_ASSERT(pair.start == i);
-+ isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft();
-+ }
- doEmbed(isRtl, false, true);
-- ++isolatePairPosition;
- break;
- }
-
-diff --git a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
-index 9c477589f93..f0a32c2ed40 100644
---- a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
-+++ b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp
-@@ -138,6 +138,7 @@ private slots:
- void noModificationOfInputString();
- void superscriptCrash_qtbug53911();
- void showLineAndParagraphSeparatorsCrash();
-+ void tooManyDirectionalCharctersCrash_qtbug77819();
-
- private:
- QFont testFont;
-@@ -2309,5 +2310,21 @@ void tst_QTextLayout::nbspWithFormat()
- QCOMPARE(layout.lineAt(1).textLength(), s2.length() + 1 + s3.length());
- }
-
-+void tst_QTextLayout::tooManyDirectionalCharctersCrash_qtbug77819()
-+{
-+ QString data;
-+ data += QString::fromUtf8("\xe2\x81\xa8"); // U+2068 FSI character
-+ data += QString::fromUtf8("\xe2\x81\xa7"); // U+2067 RLI character
-+
-+ // duplicating the text
-+ for (int i = 0; i < 10; i++)
-+ data += data;
-+
-+ // Nothing to test. It must not crash in beginLayout().
-+ QTextLayout tl(data);
-+ tl.beginLayout();
-+ tl.endLayout();
-+}
-+
- QTEST_MAIN(tst_QTextLayout)
- #include "tst_qtextlayout.moc"
---
-2.16.3
diff --git a/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch b/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch
new file mode 100644
index 000000000000..6a9c9921b7d0
--- /dev/null
+++ b/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch
@@ -0,0 +1,106 @@
+From 276fa8383a7535765be7182883ef4aade17ce013 Mon Sep 17 00:00:00 2001
+From: Thiago Macieira <thiago.macieira@intel.com>
+Date: Thu, 2 Apr 2020 12:08:41 -0300
+Subject: [PATCH] QLibrary: fix deadlock caused by fix to QTBUG-39642
+
+Commit ae6f73e8566fa76470937aca737141183929a5ec inserted a mutex around
+the entire load_sys(). We had reasoed that deadlocks would only occur if
+the object creation in instance() recursed into its own instance(),
+which was already a bug. But we had forgotten that dlopen()/
+LoadLibrary() executes initialization code from the module being loaded,
+which could cause a recursion back into the same QPluginLoader or
+QLibrary object. This recursion is benign because the module *is* loaded
+and dlopen()/LoadLibrary() returns the same handle.
+
+[ChangeLog][QtCore][QLibrary and QPluginLoader] Fixed a deadlock that
+would happen if the plugin or library being loaded has load-time
+initialization code (C++ global variables) that recursed back into the
+same QLibrary or QPluginLoader object.
+
+PS: QLibraryPrivate::loadPlugin() updates pluginState outside a mutex
+lock, so pluginState should be made an atomic variable. Once that is
+done, we'll only need locking the mutex to update errorString (no
+locking before loading).
+
+Fixes: QTBUG-83207
+Task-number: QTBUG-39642
+Change-Id: Ibdc95e9af7bd456a94ecfffd160209304e5ab2eb
+Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
+Reviewed-by: David Faure <david.faure@kdab.com>
+---
+ src/corelib/plugin/qlibrary.cpp | 2 --
+ src/corelib/plugin/qlibrary_unix.cpp | 4 ++++
+ src/corelib/plugin/qlibrary_win.cpp | 3 +++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp
+index ddb053c26fa..be9d92b2048 100644
+--- a/src/corelib/plugin/qlibrary.cpp
++++ b/src/corelib/plugin/qlibrary.cpp
+@@ -576,9 +576,7 @@ bool QLibraryPrivate::load()
+
+ Q_TRACE(QLibraryPrivate_load_entry, fileName);
+
+- mutex.lock();
+ bool ret = load_sys();
+- mutex.unlock();
+ if (qt_debug_component()) {
+ if (ret) {
+ qDebug() << "loaded library" << fileName;
+diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp
+index 017aa97b66a..a5c72f81d96 100644
+--- a/src/corelib/plugin/qlibrary_unix.cpp
++++ b/src/corelib/plugin/qlibrary_unix.cpp
+@@ -123,6 +123,7 @@ QStringList QLibraryPrivate::prefixes_sys()
+
+ bool QLibraryPrivate::load_sys()
+ {
++ QMutexLocker locker(&mutex);
+ QString attempt;
+ QFileSystemEntry fsEntry(fileName);
+
+@@ -213,6 +214,7 @@ bool QLibraryPrivate::load_sys()
+ }
+ #endif
+
++ locker.unlock();
+ bool retry = true;
+ Handle hnd = nullptr;
+ for (int prefix = 0; retry && !hnd && prefix < prefixes.size(); prefix++) {
+@@ -273,6 +275,8 @@ bool QLibraryPrivate::load_sys()
+ }
+ }
+ #endif
++
++ locker.relock();
+ if (!hnd) {
+ errorString = QLibrary::tr("Cannot load library %1: %2").arg(fileName, qdlerror());
+ }
+diff --git a/src/corelib/plugin/qlibrary_win.cpp b/src/corelib/plugin/qlibrary_win.cpp
+index 000bf762763..ef58724be8e 100644
+--- a/src/corelib/plugin/qlibrary_win.cpp
++++ b/src/corelib/plugin/qlibrary_win.cpp
+@@ -78,6 +78,7 @@ bool QLibraryPrivate::load_sys()
+ // fileName
+ //
+ // NB If it's a plugin we do not ever try the ".dll" extension
++ QMutexLocker locker(&mutex);
+ QStringList attempts;
+
+ if (pluginState != IsAPlugin)
+@@ -95,6 +96,7 @@ bool QLibraryPrivate::load_sys()
+ attempts.prepend(QDir::rootPath() + fileName);
+ #endif
+
++ locker.unlock();
+ Handle hnd = nullptr;
+ for (const QString &attempt : qAsConst(attempts)) {
+ #ifndef Q_OS_WINRT
+@@ -115,6 +117,7 @@ bool QLibraryPrivate::load_sys()
+ #ifndef Q_OS_WINRT
+ SetErrorMode(oldmode);
+ #endif
++ locker.relock();
+ if (!hnd) {
+ errorString = QLibrary::tr("Cannot load library %1: %2").arg(
+ QDir::toNativeSeparators(fileName), qt_error_string());